CVE catalog
CVE-2020-26296
vega.js: CVE-2020-26296
- Severity
- High · CVSS 8.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.71% · Oct 25, 2026
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | vega.js | sid | 5.33.1+ds+~cs5.3.0-4 | not affected |
| Debian | vega.js | forky | 5.33.1+ds+~cs5.3.0-4 | not affected |
| Debian | vega.js | trixie | 5.28.0+ds+~cs5.3.0-1 | not affected |
| Debian | vega.js | bookworm | 5.22.1+ds+~3.1.0-4 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | vega.js | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | vega.js | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | vega.js | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | vega.js | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libjs-vega]Not affected
Source package: [vega.js]
Details (2)
5.22.1+ds+~3.1.0-4· all · bookwormNot affected
dsa · vega.js · debian · bookworm
5.22.1+ds+~3.1.0-4· all · bookwormNot affected
dsa · vega.js · debian · bookworm
- [node-vega]Not affected
Source package: [vega.js]
Details (2)
5.22.1+ds+~3.1.0-4· all · bookwormNot affected
dsa · vega.js · debian · bookworm
5.22.1+ds+~3.1.0-4· all · bookwormNot affected
dsa · vega.js · debian · bookworm
Observed: